Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Matthew Rosato <mjrosato@linux.ibm.com>
To:     alex.williamson@redhat.com, pbonzini@redhat.com
Cc:     jgg@nvidia.com, cohuck@redhat.com, farman@linux.ibm.com,
        pmorel@linux.ibm.com, borntraeger@linux.ibm.com,
        frankja@linux.ibm.com, imbrenda@linux.ibm.com, david@redhat.com,
        akrowiak@linux.ibm.com, jjherne@linux.ibm.com, pasic@linux.ibm.com,
        zhenyuw@linux.intel.com, zhi.a.wang@intel.com,
        linux-s390@vger.kernel.org, kvm@vger.kernel.org,
        intel-gvt-dev@lists.freedesktop.org,
        intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: [PATCH 0/2] kvm/vfio: fix potential deadlock on vfio group lock
Date:   Mon,  9 Jan 2023 15:10:35 -0500
Message-Id: <20230109201037.33051-1-mjrosato@linux.ibm.com>
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
Precedence: bulk

Hi Alex, Paolo,

As reported by Alex [1], since commit 421cfe6596f6 it is possible for
a kvm_put_kvm call to hit a refcount of 0 and trigger kvm_destroy_vm
while the vfio group lock is held.  However, if this occurs, and the
associated group is still in the kvm device list, this thread of
execution will attempt to acquire the vfio group lock again, resulting
in a deadlock.

This series proposes to resolve this by adding a new kvm_put_kvm_async
which behaves the same as kvm_put_kvm but, in the case where the refcount
hits 0, will use a workqueue to perform the kvm_destroy_vm asynchronously.

The fix is provided in 2 patches because s390 PCI passthrough has the same
issue, albeit introduced slightly later via a different commit.

[1]: https://lore.kernel.org/kvm/20230105150930.6ee65182.alex.williamson@redhat.com/

Matthew Rosato (2):
  KVM: async kvm_destroy_vm for vfio devices
  KVM: s390: pci: use asyncronous kvm put

 arch/s390/kvm/pci.c               |  8 ++++++--
 drivers/gpu/drm/i915/gvt/kvmgt.c  |  6 +++++-
 drivers/s390/crypto/vfio_ap_ops.c |  7 ++++++-
 include/linux/kvm_host.h          |  3 +++
 virt/kvm/kvm_main.c               | 22 ++++++++++++++++++++++
 5 files changed, 42 insertions(+), 4 deletions(-)

-- 
2.39.0